open-standards/eoc/eoc-rs
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Transaction Science ae673eb899
All checks were successful
energy meters on real hardware / RAPL and NVML on jetson-hub (pull_request) Successful in 40s
standards workspaces build + test / jouleclaw-rs (pull_request) Successful in 2m24s
standards workspaces build + test / aac-rs (pull_request) Successful in 2m52s
standards workspaces build + test / joule-code-rs (pull_request) Successful in 1m26s
standards workspaces build + test / joulecontract-rs (pull_request) Successful in 59s
standards workspaces build + test / map-rs (pull_request) Successful in 1m0s
standards workspaces build + test / mesh-rs (pull_request) Successful in 56s
standards workspaces build + test / openpay (pull_request) Successful in 2m38s
standards workspaces build + test / jouledesk-rs (pull_request) Successful in 54s
standards workspaces build + test / macOS energy backends (pull_request) Successful in 4m41s
lockfiles / every Cargo.lock is current (pull_request) Successful in 42s
spec citations resolve / Code cites no section its SPEC lacks (pull_request) Successful in 3s
standards workspaces build + test / arl-rs (pull_request) Successful in 1m10s
standards workspaces build + test / jcp-rs (pull_request) Successful in 1m51s
standards workspaces build + test / eoc-rs (pull_request) Successful in 2m13s
standards workspaces build + test / joule-ui-rs (pull_request) Successful in 1m13s
standards workspaces build + test / joulehook-rs (pull_request) Successful in 1m14s
standards workspaces build + test / proof-rs (pull_request) Successful in 1m28s
standards workspaces build + test / sandbox-rs (pull_request) Successful in 2m23s
standards workspaces build + test / sense-rs (pull_request) Successful in 1m9s
tests in CI / every test file is run by a job or listed with its reason (pull_request) Successful in 4s
standards workspaces build + test / smart-byte-rs (pull_request) Successful in 4m0s
eoc-meter: a GPU rise the oracle saw is not one the probe must have seen
`the_production_probe_hands_the_rule_what_the_oracle_reads` failed once on an
otherwise green tree -- the only failure of that job across 309 commits:

  ("GPU Energy", 0) moved 1508467856154491 -> 1508467860032551 across the
  oracle's reads, but every one of the 20 samples the production probe took
  read [1508467856154491]

The assertion behind it does not hold. The oracle's two reads *bracket* the
probe's samples, so a rise it saw can fall entirely outside the probe's own
window. GPU energy is activity-driven, not a clock: it rises only while the GPU
works, so on a shared host another process's short burst lands between the
oracle's first read and the probe's first sample as readily as inside it. The
observed delta is about one tick's worth. One value is therefore no evidence of
a sampler that is not sampling.

The same block already reasons this way one branch over -- a rail that held
across the bracket is reported with "freshness is NOT asserted on it" -- and
sandbox-meter's equivalent prints its GPU-hold case rather than asserting it.
This applies that reasoning to the case where the rail moved: the count of
distinct values is reported either way, and nothing is asserted from it.

Every other assertion is untouched, including the one that each handed sample
lies within the oracle's bracket.

What this gives up: a sampler that cached one reading and handed it back would
no longer be caught here. The liveness tests are what cover a rail that does
not advance (`the_liveness_probe_never_reports_a_frozen_rail_as_live`,
`the_ioreport_meter_is_never_available_on_a_frozen_cpu_rail`). Restoring a
sound version of this check means driving GPU work inside the probe's own
window, so a rise is guaranteed to be there to see; that is a larger change
than this one.

Verified on the IOReport host: 17 of 17 `macos_ioreport` tests and all 80
eoc-meter lib tests pass. That run took the held branch, so it exercises the
paths around this change rather than the rare case itself, which by
construction cannot be forced.

Co-Authored-By: Claude Opus 5 <[email protected]>
2026-10-14 02:45:40 -04:00
..
crates eoc-meter: a GPU rise the oracle saw is not one the probe must have seen 2026-10-14 02:45:40 -04:00
Cargo.lock eoc-agent: a local model's measured step is a measured span 2026-10-01 01:27:42 -04:00
Cargo.toml msrv: raise the rust-version floor to 1.97 across the workspaces 2026-07-23 00:17:08 -04:00
LICENSE licences: ship the Apache-2.0 text the code already declares 2026-10-09 17:22:32 -04:00
README.md eoc docs: what a resolve is charged, with the measured figures; the example prints the unmetered baseline 2026-10-13 02:22:58 -04:00
rust-toolchain.toml chore(deps): cargo update across the workspace; eoc toolchain → 1.98.0 2026-08-26 07:39:26 -04:00

eoc-rs — EOC reference implementation in Rust

Apache-2.0 reference implementation of the Energy-Optimized Compute specification (CC-BY-4.0 spec lives in ../spec/).

EOC is a four-stage memoizing cascade. Every query is tried at each stage in turn and the first that can answer wins. The four stages, cheapest to most expensive, are:

  1. Cache (eoc-cache) — content-addressed LRU. Cache hits are nearly free.
  2. Key-value (eoc-kv) — exact key match plus cosine-similarity embedding match.
  3. Graph (eoc-graph) — triple-store retrieval. Reference impl is a small in-memory matcher; production deployments swap in a real graph backend driven by DCY (EOC-4).
  4. Neural (eoc-neural) — last-resort inference. Reference impl ships an EchoBackend; production deployments wire in llama.cpp / Ollama / Anthropic API / etc.

Joule cost is the unit of accounting. The eoc-meter crate reads cumulative micro-joules from whatever whole-work hardware counter is available and live (Linux RAPL, Apple Silicon IOReport; NVIDIA NVML behind the cuda feature is GPU telemetry, never the cascade's counter) and falls back to a StubCounter everywhere else — including WASM.

What a resolve is charged

A cost is Measured only when every micro-joule of it was read from a live counter over the work it is booked to; anything else is Estimated. The cascade reads its meter where the meter can resolve the work, and nowhere else.

  • A resolve the neural stage answers is read. Two reads of the meter bracket the stage, the first taken once the cache, the KV stage and the graph have missed. The span is combined with the cost the stage reported: measured when the stage estimated nothing, the larger of the two readings when the stage metered itself, an estimate when the stage estimated. The three misses are spent before the first read and are not in the figure; the meter's own closing cost is. On an M3 Ultra the misses together took 220 ns and 0.95 µJ, and a span over no work read 12 to 29 µJ, so the measured figure is not under the neural stage's energy.
  • A resolve the cache, the KV stage or the graph answers reads no meter, and is never measured. It is charged the stage's own figure plus what a hit on that tier costs on this host. The first time a tier answers, the cascade repeats that lookup inside one span of the meter until the span reads fifty times what a span over no work does (or 40 ms have gone), and keeps the reading per lookup, in nanojoules. Every later hit on the tier is charged that, in whole micro-joules with the remainder carried to the next hit, so the micro-joules charged over any number of hits sum to the calibrated total. Cascade::calibration returns the figure, the batch, the span and the empty span, or why a tier has none; Cascade::calibrate calibrates again; Cascade::without_hit_calibration switches a tier off.

A hit is not bracketed because a read of a counter costs more than a hit. The in-process counter on macOS takes each read only once the reading thread is seen to have left its core, about 80 µs. With a span around every resolve, 10,000 cache hits took 1,647 ms on that host, 164 µs each, and each was sealed as a measured 13 to 28 µJ: the meter's own cost, the same as a span around a neural stage that does nothing. Without it they take 4.2 ms, 0.38 µs each, and are charged the 1.2 to 1.7 µJ a cache hit was calibrated at there (2.6 to 3.4 µJ for a KV or graph hit; the calibration takes 1 to 2.4 ms, once a tier), as an estimate: read by this counter on this host, but over a batch, and the mean of a batch is not a reading of any one hit.

With no live counter there is no calibration and no span, and every resolve keeps the cost its stage reported.

Workspace layout

Crate Purpose
eoc-core Types: Query, Response, Stage, JouleCost, Receipt.
eoc-cache Stage 1 — LRU cache + the Stage trait.
eoc-kv Stage 2 — KV + embedding-similarity lookup.
eoc-graph Stage 3 — in-memory triple store.
eoc-neural Stage 4 — neural inference trait + EchoBackend.
eoc-meter Hardware energy counters with stub fallback.
eoc-cascade Glue: walks the four stages, attributes joule cost.
eoc Reference CLI.
eoc-wasm wasm-bindgen wrapper — browser-runnable cascade.

Running

cargo test --workspace
cargo clippy --workspace --all-targets
cargo run --bin eoc -- query "what is 2+2"
cargo run --bin eoc -- meter

Example output, on a host with no live counter, where the cost is the stage's own figure:

$ cargo run --bin eoc -- query "what is 2+2"
stage  : kv
payload: 4
cost   : 50 µJ (estimated)
hit    : the kv stage's own figure; no calibration by stub (the counter did not advance)
receipt: <64-char hex>

and on a Mac whose in-process counter is live (--release; the stage's 50 µJ plus the calibrated figure):

$ cargo run --release --bin eoc -- query "what is 2+2"
stage  : kv
payload: 4
cost   : 53 µJ (estimated)
hit    : a kv hit is charged 3357 nJ on this host, on top of the stage's own figure: process-energy read 6876 µJ over 2048 lookups in one span (24 µJ over none)
receipt: <64-char hex>

cargo run --release -p eoc-cascade --example hit_cost prints what each tier's hit takes and is charged on the host it runs on.

CUDA / NVML

NVIDIA NVML support is feature-gated and off by default so the workspace builds without libnvidia-ml. NVML's total-energy counter reads the GPU alone, so detect() never hands it to the cascade, whose costs carry no field to say a figure covers part of the work: NvmlCounter is GPU telemetry, read beside the whole-work counter, and it is constructed only while its counter is live and counts no faster than the board can draw. To enable:

cargo build -p eoc-meter --features cuda

WASM

The cascade compiles to wasm32-unknown-unknown. The meter does not — RAPL, NVML, and powermetrics are all absent in the browser, so WASM builds use StubCounter and report estimated joule cost.

rustup target add wasm32-unknown-unknown
cargo build -p eoc-wasm --target wasm32-unknown-unknown --release
wasm-bindgen target/wasm32-unknown-unknown/release/eoc_wasm.wasm \
    --out-dir ./pkg --target web

Then from JavaScript:

import init, { WasmCascade } from "./pkg/eoc_wasm.js";
await init();
const cascade = new WasmCascade();
const r = await cascade.resolve("ping");
console.log(r); // { stage: "kv", payload: "pong", microjoules: 50, ... }

License

Apache-2.0 for the Rust source in this workspace. The EOC specification text in ../spec/ is CC-BY-4.0. See ../LICENSE.